iOS and iPad OS Security
iOS and iPad OS Security
Do you have an iPhone or iPad and want to set it up for the highest level of security and privacy? We have prepared a detailed guide for you that will help you set up all the security features in the iOS, iPad OS operating systems and protect your device and your privacy.
The guide is applicable to devices with the operating systems iOS 16.3, iPadOS 16.3 (and later). Some steps do not apply to older versions of the operating systems.
1. Check your SoC (processor)
Processors older than the Apple A12, i.e. the Apple A11 and older, contain critical vulnerabilities, which cannot be fixed with a software update. The Apple A12 also adds important hardware protections, such as PAC, which makes attacks on devices much more difficult. It also has important improvements in the area of protecting critical data, namely the improved Secure Storage Component. You can check the SoC version in your device directly in the technical specifications on the Apple website, or using the free AIDA64 application. If you have an older system and you have sensitive data on your device, we recommend replacing the device. Even if you do not have sensitive data on your device, we recommend considering this factor when choosing your next Apple device.
2. Update your software
The best way to keep your devices and the data on them safe is to keep your operating system up to date. The latest versions of Apple's operating systems, including a list of vulnerabilities fixed in each update, are available on the Apple security updates website. We recommend that you turn on automatic updates for your operating system, which you can turn on by going to Settings → General → Software Update → Turn on Download iOS / iPad OS Updates and Install iOS / iPad OS Updates.
We also recommend turning on Security Measures and System Files. This optional feature allows you to receive important security updates to fix vulnerabilities without waiting for the next update.
It is also important to keep your installed apps updated. You can turn on automatic app updates as follows: Settings → App Store → Turn on App Updates.
3. Enable DNS over HTTPS (DoH)
Using encrypted DNS protects your privacy by making queries unreadable to other parties. It also ensures the authenticity of responses, preventing DNS hijacking attacks. You can also set up a DNS resolver that will also block malicious websites. You can set up encrypted DNS communication using configuration profiles. We recommend using the following configuration profile, which will set your DNS resolver to Cloudflare, enable DNS over HTTPS, and also block malicious websites.
4. Turn on 10-fail password wipe
10-fail password wipe protects you not only from attackers manually entering your password, but also from automated programs and devices trying different passwords. In addition, this protection is implemented in a secure environment, which makes it extremely difficult to bypass. You can turn on this protection as follows: Settings → Touch ID & Passcode / Face ID & Passcode → Wipe Data. You can also turn on this protection for Apple Watch in the Watch app → Passcode → Turn on Wipe Data.
In this menu, we also recommend checking whether USB accessories are disabled, and on devices with Face ID, we recommend enabling Require Attention for Face ID. The disabled itemUSB accessories will not allow USB data connections after one hour of locking the device, which prevents the use of hardware tools to unlock your device. Require Attention for Face ID, on the other hand, will only allow unlocking the device with Face ID when you are looking at the device. This will prevent attackers from unlocking your device, for example, while you are sleeping.
5. Install a content blocker in Safari
The Safari browser allows you to install third-party content blockers. These content blockers can block both ads and trackers, as well as various malicious and fraudulent sites. The way these content blockers are implemented also protects your browsing data from the content blockers themselves. Therefore, the user does not have to trust individual content blockers, unlike browser extensions.
Installed content blockers can be enabled in Settings → Safari → Extensions, under Enable the following content blockers. Popular content blockers include AdGuard and 1Blocker.
6. Stop websites and apps from tracking your activity
iOS and iPad OS can provide apps with a unique identifier that allows them to track you across other apps. You can turn off the sharing of this identifier for individual apps in Settings → Privacy → Tracking. Turning off Allow apps to request tracking will remove all access to the identifier and automatically deny all future requests.
You can turn off tracking in Safari in Settings → Safari → Turn off Privacy-Based Ad Evaluation.
7. Turn off sending your location and data for telemetry and service improvement purposes
Apple systems send data about your devices, your habits, and also your location for the purpose of improving services. You can turn off sending your location for the purpose of improving services using the option: Settings → Privacy → Location Services → System Services → Turn off iPhone Analytics, Directions & Traffic, Improve Maps.
You can turn off sending data using: Settings → Privacy → Analytics & Improvement → Turn off Share iPhone (and Watch) Analytics.
8. Check sensitive app permissions
iOS and iPad OS apps operate in a sandbox, where they only have access to user data that the user approves. However, many apps request permissions that are not necessary for their functionality, in order to track the user. It is also a good practice to remove permissions for unused apps.
You can check app permissions in the Settings → Privacy menu, and the most sensitive permissions related to personal data include Location Services, Contacts, Calendars, Reminders, Photos, Microphone, Camera, Health. Permissions for Bluetooth and Local network are often abused to track the user.
9. Turn off content on the lock screen that you don't need there
In menu In the Settings menu → Face ID & Passcode / Touch ID & Passcode → under under Allow access from lock screen, you can turn off some features that are accessible from the lock screen by default. Features like Siri have been used to bypass the lock screen in the past, so it is recommended to turn off all features that you are not actively using.
10. Turn on the Private Relay feature
Private Relay (iCloud Private Relay), works on a similar principle to a VPN, i.e. it encrypts all communication in Safari. Your browsing data is protected from attackers listening on the network and your IP address is hidden from websites. Private Relay is available to those who have subscribed to at least 50GB of iCloud storage. You can turn it on in Settings → Safari → Hide IP Address → Select From Trackers and Websites.
11. Encrypt device backups on your computer
If you use Finder or iTunes to back up your devices, we strongly recommend that you protect your backups with a strong password. Unencrypted backups are a potential vulnerability, and an attacker who gains access to your computer would also gain access to the data on your phone or tablet. You can read more about encrypting backups in Finder or iTunes in Apple’s documentation.
12. Turn on Find function
Find My iPhone, iPad, and Watch lets you remotely locate, erase, and ring a lost device. This is possible on some devices even when they are offline or turned off. You can activate Find function in Settings → Your Name → Find My iPhone/iPad → and turn on Find My iPhone/iPad, Find My Network, Send Last Location..
13. Make sure you only sync the data you want to iCloud
Not all data synced to iCloud from your devices is protected by end-to-end encryption. Some data, such as photos, contacts, browser bookmarks, or device backups, is encrypted only in a way that is still readable by Apple and third parties with whom Apple shares the data. A list of data that is and is not protected by end-to-end encryption is available in Apple’s documentation.
It is recommended to turn off backups of data that you do not need to have backed up in the cloud. You can see the list of data that is backed up in the following menu: Settings → Your name → iCloud..
14. Turn on Advanced Data Protection for iCloud
Advanced Data Protection for iCloud provides a high level of security for your data stored in the cloud available on your devices. When this mode is enabled, most of your data in iCloud, such as backups, photos, notes, and more, protected by end-to-end encryption. This means your data is encrypted before it’s sent to Apple’s servers, so it stays secure even if your data is compromised in the cloud. Your data stays private and inaccessible to anyone, not even Apple.
Settings → Your Name → iCloud → Advanced Data Protection → Turn on Advanced Data Protection
15. Lockdown Mode
Lockdown Mode is a powerful device protection that can be activated to protect people at high risk of attack. In this mode, some app features are blocked or restricted to provide greater device protection. For example, incoming FaceTime calls are blocked if you have not previously called the person or contact, certain web technologies, or the installation of configuration profiles are also blocked. Despite the restrictions, users in Lockdown Mode can still use phone calls and text messages, as well as emergency functions. For a detailed list of apps and restrictions, see Apple's documentation. dokumentácii od spoločnosti Apple.
You can activate Lockdown Mode as follows: Settings → Privacy & Security → Lockdown Mode.
It is possible to exclude certain applications or websites from the device's lock mode only if necessary and only if the application or website is trustworthy. You can disable the exclusion of certain applications in this way: Settings → Privacy → Lock mode → Configure web browsing.
16. Stolen Device Protection
For Apple mobile devices with the operating system iOS 17 and later, there is a Stolen Device Protectionfeature that secures sensitive applications and functions if the device is stolen. It works based on so-called known locations (home, work, ...), and if the device is located in some other location, it will require you to perform biometric authentication (Face ID or Touch ID) when accessing sensitive applications without alternative authentication via password.